T09 · Insecure Skill Coding Practices
Error
- Location
scripts/yufluent_api.py:213- Finding
Bearer Token and User Dataset Can Be Transmitted Over Plaintext HTTP
- Content
View full analysis
str: base = (base_url or "").strip().rstrip("/") if not base: base = "http://localhost:8080/v1" if base.endswith("/v1"): return base return f"{base}/v1" ``` The API key is placed in a bearer authorization header: ```python def _auth_headers(api_key: str) -> dict[str, str]: return { "Authorization": f"Bearer {api_key}", "Accept": "application/json", } def _json_headers(api_key: str) -> dict[str, str]: return {**_auth_headers(api_key), "Content-Type": "application/json"} ``` The bearer token and JSON body are then submitted to the configured URL without validating its scheme: ```python def _post_json( url: str, *, api_key: str, body: dict[str, Any] | None = None, timeout: float, ) -> requests.Response: kwargs: dict[str, Any] = { "headers": _json_headers(api_key) if body is not None else _auth_headers(api_key), "timeout": timeout, } if body is not None: kwargs["json"] = body return requests.post(url, **kwargs) ``` The affected call passes the complete skill payload: ```python root = base_url or os.getenv("TOKENAPI_BASE_URL", "") url = skill_run_url(root, skill_id) try: resp = _post_json(url, api_key=key, body=payload, timeout=timeout) except requests.RequestException as exc: raise YufluentApiError(f"Request failed: {exc}") from exc ``` The insecure HTTP configuration is also presented in project documentation: ```powershell $env:TOKENAPI_BASE_URL = "http://localhost:8080/v1" ``` ### Technical Analysis The skill legitimately requires network access because its decl ...[truncated 2667 chars]- Remediation
View remediation
None: parsed = urlparse(url) loopback_hosts = {"localhost", "127.0.0.1", "::1"} if parsed.scheme == "https": return if parsed.scheme == "http" and parsed.hostname in loopback_hosts: return raise ValueError("TOKENAPI_BASE_URL must use HTTPS for non-loopback endpoints") ``` 2. Prefer an HTTPS production URL as the documented/default cloud endpoint. If local HTTP is required for development, make it an explicit development-only opt-in. 3. Disable cross-origin redirects for authenticated POST requests, or validate every redirect destination before forwarding credentials. 4. Never forward the bearer token to a host different from the explicitly approved API host. 5. Add a clear pre-upload disclosure stating that the complete competitor dataset and optional listing are transmitted to the configured service. 6. Add automated tests proving that: - Remote HTTP endpoints are rejected. - Loopback exceptions are narrowly scoped. - Credentials are not forwarded across host-changing redirects. 7. Encourage token rotation and provide narrowly scoped, short-lived API credentials where supported. ]]>